WORM_PHORPIEX.THFADAK

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm adds the following folders:

• {removable or network drive}:\_
• %Windows%\T-406280757284502620

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• {removable or network drive}:\_\DeviceManager.exe

It drops the following copies of itself into the affected system and executes them:

• %Windows%\T-406280757284502620\winsvcs.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following files:

• %Start Menu%\winsvcs.exe
• %User Temp%\Windows Archive Manager.exe
• {removable/network drive}:\.lnk
• {removable/network drive}:\autorun.inf
• %Application Data%\winzip.txt
• %Start Menu%\Programs\winsvcs.exe
• %Application Data%\winmgrcfg32.txt

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista, 7, and 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

Autostart Technique

This Worm drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\winsvcs.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Download Routine

This Worm saves the files it downloads using the following names:

• %User temp%/{Random Numbers}.exe

Other Details

This Worm connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}.197.60/{t | m | r | o}.exe
• http://{BLOCKED}.{BLOCKED.197.112/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefua.ru/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfha.ru/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaifa.ru/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefofa.ru/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizara.ru/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaia.ru/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiaa.ru/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehfa.ru/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezra.ru/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazera.ru/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadfa.ru/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufja.ru/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhra.ru/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueua.ru/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueuea.ru/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufua.ru/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudaga.ru/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduuda.ru/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfna.ru/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuhea.ru/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsia.ru/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgura.ru/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususa.ru/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgsa.ru/{t | m | r | o}.exe
• http://{BLOCKED}gafuaodeuadga.ru/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefub.su/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhb.su/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaifb.su/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefofb.su/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizarb.su/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaib.su/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiab.su/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehfb.su/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezrb.su/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazerb.su/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadfb.su/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufjb.su/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhrb.su/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueub.su/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueueb.su/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufub.su/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudagb.su/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduudb.su/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfnb.su/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuheb.su/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsib.su/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgurb.su/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususb.su/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgsb.su/{t | m | r | o}.exe
• http://{BLOCKED}gafuaodeuadgb.su/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefuc.in/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhc.in/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaifc.in/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefofc.in/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizarc.in/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaic.in/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiac.in/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehfc.in/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezrc.in/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazerc.in/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadfc.in/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufjc.in/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhrc.in/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueuc.in/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueuec.in/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufuc.in/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudagc.in/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduudc.in/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfnc.in/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuhec.in/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsic.in/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgurc.in/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususc.in/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgsc.in/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefud.to/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhd.to/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaifd.to/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefofd.to/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizard.to/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaid.to/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiad.to/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehfd.to/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezrd.to/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazerd.to/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadfd.to/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufjd.to/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhrd.to/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueud.to/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueued.to/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufud.to/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudagd.to/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduudd.to/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfnd.to/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuhed.to/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsid.to/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgurd.to/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususd.to/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgsd.to/{t | m | r | o}.exe
• http://{BLOCKED}gafuaodeuadgd.to/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefue.biz/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhe.biz/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaife.biz/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefofe.biz/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizare.biz/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaie.biz/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiae.biz/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehfe.biz/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezre.biz/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazere.biz/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadfe.biz/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufje.biz/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhre.biz/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueue.biz/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueuee.biz/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufue.biz/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudage.biz/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduude.biz/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfne.biz/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuhee.biz/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsie.biz/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgure.biz/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususe.biz/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgse.biz/{t | m | r | o}.exe
• http://{BLOCKED}gafuaodeuadge.biz/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefuf.net/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhf.net/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaiff.net/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefoff.net/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizarf.net/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaif.net/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiaf.net/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehff.net/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezrf.net/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazerf.net/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadff.net/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufjf.net/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhrf.net/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueuf.net/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueuef.net/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufuf.net/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudagf.net/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduudf.net/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfnf.net/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuhef.net/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsif.net/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgurf.net/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususf.net/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgsf.net/{t | m | r | o}.exe
• http://{BLOCKED}gafuaodeuadgf.net/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefug.com/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhg.com/{t | m | r | o}.exe
• http://{BLOCKED}iaeaizgdeaifg.com/{t | m | r | o}.exe
• http://{BLOCKED}ueaboufaefofg.com/{t | m | r | o}.exe
• http://{BLOCKED}aebdaezfizarg.com/{t | m | r | o}.exe
• http://{BLOCKED}zgdizagwdwaig.com/{t | m | r | o}.exe
• http://{BLOCKED}zediagzeagiag.com/{t | m | r | o}.exe
• http://{BLOCKED}eiauoahadehfg.com/{t | m | r | o}.exe
• http://{BLOCKED}bdzizezezezrg.com/{t | m | r | o}.exe
• http://{BLOCKED}bizeziizazerg.com/{t | m | r | o}.exe
• http://{BLOCKED}ruaroarouadfg.com/{t | m | r | o}.exe
• http://{BLOCKED}nnsnsnsnsufjg.com/{t | m | r | o}.exe
• http://{BLOCKED}nnnnnvnhshhrg.com/{t | m | r | o}.exe
• http://{BLOCKED}djsisidifueug.com/{t | m | r | o}.exe
• http://{BLOCKED}ofahfueuueueg.com/{t | m | r | o}.exe
• http://{BLOCKED}pckjuuuufufug.com/{t | m | r | o}.exe
• http://{BLOCKED}auaaauaaudagg.com/{t | m | r | o}.exe
• http://{BLOCKED}pgkurueuduudg.com/{t | m | r | o}.exe
• http://{BLOCKED}ueuueueufhfng.com/{t | m | r | o}.exe
• http://{BLOCKED}ivhzdhsuvuheg.com/{t | m | r | o}.exe
• http://{BLOCKED}eunddjvgsnsig.com/{t | m | r | o}.exe
• http://{BLOCKED}hfbtehszfgurg.com/{t | m | r | o}.exe
• http://{BLOCKED}ueiugzgjususg.com/{t | m | r | o}.exe
• http://{BLOCKED}zbisfiuefzgsg.com/{t | m | r | o}.exe
• http://{BLOCKED}gafuaodeuadgg.com/{t | m | r | o}.exe
• http://{BLOCKED}sfuoehfoaefux.info/{t | m | r | o}.exe
• http://{BLOCKED}rhosruuosrfhx.info/{t | m | r | o}.exe
• http://{BLOCKED}.{BLOCKED}.197.60/t.php?new=1
• http://{BLOCKED}.{BLOCKED}.197.112/t.php?new=1
• http://{BLOCKED}foaefua.ru/t.php?new=1
• http://{BLOCKED}uosrfha.ru/t.php?new=1
• http://{BLOCKED}gdeaifa.ru/t.php?new=1
• http://{BLOCKED}faefofa.ru/t.php?new=1
• http://{BLOCKED}zfizara.ru/t.php?new=1
• http://{BLOCKED}gwdwaia.ru/t.php?new=1
• http://{BLOCKED}zeagiaa.ru/t.php?new=1
• http://{BLOCKED}hadehfa.ru/t.php?new=1
• http://{BLOCKED}zezezra.ru/t.php?new=1
• http://{BLOCKED}izazera.ru/t.php?new=1
• http://{BLOCKED}rouadfa.ru/t.php?new=1
• http://{BLOCKED}snsufja.ru/t.php?new=1
• http://{BLOCKED}nhshhra.ru/t.php?new=1
• http://{BLOCKED}difueua.ru/t.php?new=1
• http://{BLOCKED}euueuea.ru/t.php?new=1
• http://{BLOCKED}uufufua.ru/t.php?new=1
• http://{BLOCKED}aaudaga.ru/t.php?new=1
• http://{BLOCKED}euduuda.ru/t.php?new=1
• http://{BLOCKED}eufhfna.ru/t.php?new=1
• http://{BLOCKED}suvuhea.ru/t.php?new=1
• http://{BLOCKED}vgsnsia.ru/t.php?new=1
• http://{BLOCKED}szfgura.ru/t.php?new=1
• http://{BLOCKED}gjususa.ru/t.php?new=1
• http://{BLOCKED}uefzgsa.ru/t.php?new=1
• http://{BLOCKED}gafuaodeuadga.ru/t.php?new=1
• http://{BLOCKED}sfuoehfoaefub.su/t.php?new=1
• http://{BLOCKED}rhosruuosrfhb.su/t.php?new=1
• http://{BLOCKED}iaeaizgdeaifb.su/t.php?new=1
• http://{BLOCKED}ueaboufaefofb.su/t.php?new=1
• http://{BLOCKED}aebdaezfizarb.su/t.php?new=1
• http://{BLOCKED}zgdizagwdwaib.su/t.php?new=1
• http://{BLOCKED}zediagzeagiab.su/t.php?new=1
• http://{BLOCKED}eiauoahadehfb.su/t.php?new=1
• http://{BLOCKED}bdzizezezezrb.su/t.php?new=1
• http://{BLOCKED}bizeziizazerb.su/t.php?new=1
• http://{BLOCKED}ruaroarouadfb.su/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufjb.su/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhrb.su/t.php?new=1
• http://{BLOCKED}djsisidifueub.su/t.php?new=1
• http://{BLOCKED}ofahfueuueueb.su/t.php?new=1
• http://{BLOCKED}pckjuuuufufub.su/t.php?new=1
• http://{BLOCKED}auaaauaaudagb.su/t.php?new=1
• http://{BLOCKED}pgkurueuduudb.su/t.php?new=1
• http://{BLOCKED}ueuueueufhfnb.su/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuheb.su/t.php?new=1
• http://{BLOCKED}eunddjvgsnsib.su/t.php?new=1
• http://{BLOCKED}hfbtehszfgurb.su/t.php?new=1
• http://{BLOCKED}ueiugzgjususb.su/t.php?new=1
• http://{BLOCKED}zbisfiuefzgsb.su/t.php?new=1
• http://{BLOCKED}gafuaodeuadgb.su/t.php?new=1
• http://{BLOCKED}sfuoehfoaefuc.in/t.php?new=1
• http://{BLOCKED}rhosruuosrfhc.in/t.php?new=1
• http://{BLOCKED}iaeaizgdeaifc.in/t.php?new=1
• http://{BLOCKED}ueaboufaefofc.in/t.php?new=1
• http://{BLOCKED}aebdaezfizarc.in/t.php?new=1
• http://{BLOCKED}zgdizagwdwaic.in/t.php?new=1
• http://{BLOCKED}zediagzeagiac.in/t.php?new=1
• http://{BLOCKED}eiauoahadehfc.in/t.php?new=1
• http://{BLOCKED}bdzizezezezrc.in/t.php?new=1
• http://{BLOCKED}bizeziizazerc.in/t.php?new=1
• http://{BLOCKED}ruaroarouadfc.in/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufjc.in/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhrc.in/t.php?new=1
• http://{BLOCKED}djsisidifueuc.in/t.php?new=1
• http://{BLOCKED}ofahfueuueuec.in/t.php?new=1
• http://{BLOCKED}pckjuuuufufuc.in/t.php?new=1
• http://{BLOCKED}auaaauaaudagc.in/t.php?new=1
• http://{BLOCKED}pgkurueuduudc.in/t.php?new=1
• http://{BLOCKED}ueuueueufhfnc.in/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuhec.in/t.php?new=1
• http://{BLOCKED}eunddjvgsnsic.in/t.php?new=1
• http://{BLOCKED}hfbtehszfgurc.in/t.php?new=1
• http://{BLOCKED}ueiugzgjususc.in/t.php?new=1
• http://{BLOCKED}zbisfiuefzgsc.in/t.php?new=1
• http://{BLOCKED}sfuoehfoaefud.to/t.php?new=1
• http://{BLOCKED}rhosruuosrfhd.to/t.php?new=1
• http://{BLOCKED}iaeaizgdeaifd.to/t.php?new=1
• http://{BLOCKED}ueaboufaefofd.to/t.php?new=1
• http://{BLOCKED}aebdaezfizard.to/t.php?new=1
• http://{BLOCKED}zgdizagwdwaid.to/t.php?new=1
• http://{BLOCKED}zediagzeagiad.to/t.php?new=1
• http://{BLOCKED}eiauoahadehfd.to/t.php?new=1
• http://{BLOCKED}bdzizezezezrd.to/t.php?new=1
• http://{BLOCKED}bizeziizazerd.to/t.php?new=1
• http://{BLOCKED}ruaroarouadfd.to/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufjd.to/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhrd.to/t.php?new=1
• http://{BLOCKED}djsisidifueud.to/t.php?new=1
• http://{BLOCKED}ofahfueuueued.to/t.php?new=1
• http://{BLOCKED}pckjuuuufufud.to/t.php?new=1
• http://{BLOCKED}auaaauaaudagd.to/t.php?new=1
• http://{BLOCKED}pgkurueuduudd.to/t.php?new=1
• http://{BLOCKED}ueuueueufhfnd.to/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuhed.to/t.php?new=1
• http://{BLOCKED}eunddjvgsnsid.to/t.php?new=1
• http://{BLOCKED}hfbtehszfgurd.to/t.php?new=1
• http://{BLOCKED}ueiugzgjususd.to/t.php?new=1
• http://{BLOCKED}zbisfiuefzgsd.to/t.php?new=1
• http://{BLOCKED}gafuaodeuadgd.to/t.php?new=1
• http://{BLOCKED}sfuoehfoaefue.biz/t.php?new=1
• http://{BLOCKED}rhosruuosrfhe.biz/t.php?new=1
• http://{BLOCKED}iaeaizgdeaife.biz/t.php?new=1
• http://{BLOCKED}ueaboufaefofe.biz/t.php?new=1
• http://{BLOCKED}aebdaezfizare.biz/t.php?new=1
• http://{BLOCKED}zgdizagwdwaie.biz/t.php?new=1
• http://{BLOCKED}zediagzeagiae.biz/t.php?new=1
• http://{BLOCKED}eiauoahadehfe.biz/t.php?new=1
• http://{BLOCKED}bdzizezezezre.biz/t.php?new=1
• http://{BLOCKED}bizeziizazere.biz/t.php?new=1
• http://{BLOCKED}ruaroarouadfe.biz/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufje.biz/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhre.biz/t.php?new=1
• http://{BLOCKED}djsisidifueue.biz/t.php?new=1
• http://{BLOCKED}ofahfueuueuee.biz/t.php?new=1
• http://{BLOCKED}pckjuuuufufue.biz/t.php?new=1
• http://{BLOCKED}auaaauaaudage.biz/t.php?new=1
• http://{BLOCKED}pgkurueuduude.biz/t.php?new=1
• http://{BLOCKED}ueuueueufhfne.biz/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuhee.biz/t.php?new=1
• http://{BLOCKED}eunddjvgsnsie.biz/t.php?new=1
• http://{BLOCKED}hfbtehszfgure.biz/t.php?new=1
• http://{BLOCKED}ueiugzgjususe.biz/t.php?new=1
• http://{BLOCKED}zbisfiuefzgse.biz/t.php?new=1
• http://{BLOCKED}gafuaodeuadge.biz/t.php?new=1
• http://{BLOCKED}sfuoehfoaefuf.net/t.php?new=1
• http://{BLOCKED}rhosruuosrfhf.net/t.php?new=1
• http://{BLOCKED}iaeaizgdeaiff.net/t.php?new=1
• http://{BLOCKED}ueaboufaefoff.net/t.php?new=1
• http://{BLOCKED}aebdaezfizarf.net/t.php?new=1
• http://{BLOCKED}zgdizagwdwaif.net/t.php?new=1
• http://{BLOCKED}zediagzeagiaf.net/t.php?new=1
• http://{BLOCKED}eiauoahadehff.net/t.php?new=1
• http://{BLOCKED}bdzizezezezrf.net/t.php?new=1
• http://{BLOCKED}bizeziizazerf.net/t.php?new=1
• http://{BLOCKED}ruaroarouadff.net/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufjf.net/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhrf.net/t.php?new=1
• http://{BLOCKED}djsisidifueuf.net/t.php?new=1
• http://{BLOCKED}ofahfueuueuef.net/t.php?new=1
• http://{BLOCKED}pckjuuuufufuf.net/t.php?new=1
• http://{BLOCKED}auaaauaaudagf.net/t.php?new=1
• http://{BLOCKED}pgkurueuduudf.net/t.php?new=1
• http://{BLOCKED}ueuueueufhfnf.net/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuhef.net/t.php?new=1
• http://{BLOCKED}eunddjvgsnsif.net/t.php?new=1
• http://{BLOCKED}hfbtehszfgurf.net/t.php?new=1
• http://{BLOCKED}ueiugzgjususf.net/t.php?new=1
• http://{BLOCKED}zbisfiuefzgsf.net/t.php?new=1
• http://{BLOCKED}gafuaodeuadgf.net/t.php?new=1
• http://{BLOCKED}sfuoehfoaefug.com/t.php?new=1
• http://{BLOCKED}rhosruuosrfhg.com/t.php?new=1
• http://{BLOCKED}iaeaizgdeaifg.com/t.php?new=1
• http://{BLOCKED}ueaboufaefofg.com/t.php?new=1
• http://{BLOCKED}aebdaezfizarg.com/t.php?new=1
• http://{BLOCKED}zgdizagwdwaig.com/t.php?new=1
• http://{BLOCKED}zediagzeagiag.com/t.php?new=1
• http://{BLOCKED}eiauoahadehfg.com/t.php?new=1
• http://{BLOCKED}bdzizezezezrg.com/t.php?new=1
• http://{BLOCKED}bizeziizazerg.com/t.php?new=1
• http://{BLOCKED}ruaroarouadfg.com/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufjg.com/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhrg.com/t.php?new=1
• http://{BLOCKED}djsisidifueug.com/t.php?new=1
• http://{BLOCKED}ofahfueuueueg.com/t.php?new=1
• http://{BLOCKED}pckjuuuufufug.com/t.php?new=1
• http://{BLOCKED}auaaauaaudagg.com/t.php?new=1
• http://{BLOCKED}pgkurueuduudg.com/t.php?new=1
• http://{BLOCKED}ueuueueufhfng.com/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuheg.com/t.php?new=1
• http://{BLOCKED}eunddjvgsnsig.com/t.php?new=1
• http://{BLOCKED}hfbtehszfgurg.com/t.php?new=1
• http://{BLOCKED}ueiugzgjususg.com/t.php?new=1
• http://{BLOCKED}zbisfiuefzgsg.com/t.php?new=1
• http://{BLOCKED}gafuaodeuadgg.com/t.php?new=1
• http://{BLOCKED}sfuoehfoaefux.info/t.php?new=1
• http://{BLOCKED}rhosruuosrfhx.info/t.php?new=1
• http://{BLOCKED}iaeaizgdeaifx.info/t.php?new=1
• http://{BLOCKED}ueaboufaefofx.info/t.php?new=1
• http://{BLOCKED}aebdaezfizarx.info/t.php?new=1
• http://{BLOCKED}zgdizagwdwaix.info/t.php?new=1
• http://{BLOCKED}zediagzeagiax.info/t.php?new=1
• http://{BLOCKED}eiauoahadehfx.info/t.php?new=1
• http://{BLOCKED}bdzizezezezrx.info/t.php?new=1
• http://{BLOCKED}bizeziizazerx.info/t.php?new=1
• http://{BLOCKED}ruaroarouadfx.info/t.php?new=1
• http://{BLOCKED}nnsnsnsnsufjx.info/t.php?new=1
• http://{BLOCKED}nnnnnvnhshhrx.info/t.php?new=1
• http://{BLOCKED}djsisidifueux.info/t.php?new=1
• http://{BLOCKED}ofahfueuueuex.info/t.php?new=1
• http://{BLOCKED}pckjuuuufufux.info/t.php?new=1
• http://{BLOCKED}auaaauaaudagx.info/t.php?new=1
• http://{BLOCKED}pgkurueuduudx.info/t.php?new=1
• http://{BLOCKED}ueuueueufhfnx.info/t.php?new=1
• http://{BLOCKED}ivhzdhsuvuhex.info/t.php?new=1
• http://{BLOCKED}eunddjvgsnsix.info/t.php?new=1
• http://{BLOCKED}hfbtehszfgurx.info/t.php?new=1
• http://{BLOCKED}ueiugzgjususx.info/t.php?new=1
• http://{BLOCKED}zbisfiuefzgsx.info/t.php?new=1
• http://{BLOCKED}gafuaodeuadgx.info/t.php?new=1
• http://{BLOCKED}.{BLOCKED}.94.107/t.php?new=1
• http://{BLOCKED}.{BLOCKED}.40.92/t.php?new=1
• http://{BLOCKED}.{BLOCKED}.228.49/t.php?new=1

  It does the following:

  • The worm executes the downloaded files.
  • Moves contents of removable and network drives to {removable and network drive letter}:\_

  However, as of this writing, the said sites are inaccessible.